The priority with teeth sits last on the working group's list of five: integrating PQC into cybersecurity requirements and procurement processes [9]. That turns a research topic into contract language, and contract language is what gets a control funded, through a vendor question, a renewal date or an audit finding. The group's diagnosis is financial rather than mathematical. It writes that the quantum threat "remains off the radar for many organizations and not properly resourced, with other security concerns taking precedence" [4].
The federal migration date moved up by five years, from 2035 to 2030 [16]. Google's own target of 2029 sits inside that new deadline by one year, and inside the old one by six [17]. These are supply chain deadlines, not attacker deadlines: they land as security questionnaires and procurement clauses before the year printed on them, which is the practical reason an inventory started now costs less than one started in answer to a customer's renewal.
The report also pulls authentication into scope, warning that quantum computers could compromise authentication and assurance mechanisms by forging trusted data or stealing confirmation, putting secure communications and legal contracts at risk [8]. That is a different asset class from a transport session key. Code signing, document signing and long-lived trust roots have to stay verifiable years after the key was generated, so they belong near the top of an inventory rather than in the phase-two column.
Uncertainty in the algorithms themselves argues for inventory over algorithm shopping. Some of the NIST-selected algorithms have already been broken with traditional computers or AI, which is why the agency backs multiple algorithms and the concept of crypto-agility [13]. The deliverable that survives that churn is a map: where keys live, which algorithms and protocols consume them, when certificates expire. Inventorying and prioritizing critical systems is what governments have been recommending for years [20], and it holds its value even if a chosen algorithm fails and a second migration follows.
Progress so far splits along regulation. The transition is on schedule in the federal government and the highly regulated financial sector, and lagging in industries where owners and operators feel they have more immediate concerns [12]. Both groups face the same arithmetic, but only one of them has a regulator asking for evidence. The working group's answer is that this "can only be achieved with early engagement, coordinated planning and informed decision making across the public and private sectors" [19]. In budget terms, that means the inventory work falls to you and the schedule falls to your suppliers.
